Computer system with tunneling

ABSTRACT

A computer system with a CPU, at least one guest operating system and a controller kernel. The controller kernel includes a socket for running an application on the controller kernel itself. The controller kernel also includes a video integration module so that video output data from the guest OS may be combined with video output data from the guest OS. In this way, a user of the guest OS can use an application by tunneling, and without the need to virtualize the video output data of the application running on the controller kernel in order to incorporate it with the video output data of the guest OS. This is especially preferred when the controller kernel is written in a different form than the guest OS, such as when the controller kernel is in LINUX and the guest OS is in a Windows form because it allows a guest OS of one form (for example, Windows) to reliably, quickly, efficiently and robustly run applications written in another form (for example, LINUX).

RELATED APPLICATION

The present application claims priority to U.S. provisional patentapplication No. 60/973,923, filed on Sep. 20, 2007; all of the foregoingpatent-related document(s) are hereby incorporated by reference hereinin their respective entirety(ies).

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to computer systems with a computerrunning multiple operating systems and more particularly to computersystems with a computer running multiple containerized (see DEFINITIONSsection) operating systems to be respectively used by multiple terminals(see DEFINITIONS section).

2. Description of the Related Art

It is conventional to have a computer, such as a modified PC desktoptype host computer, which controls and operates a plurality ofterminals. In fact, mainframe computers dating back to at least the1970s operated in this way. More recently, each terminal has been givenits own operating system and/or instance of an operating system. Thesekind of systems are herein called multi-terminal systems.

It is conventional to use a hypervisor to run multiple operating systemson a single computer. A hypervisor (or virtual machine monitor) is avirtualization platform that allows multiple operating systems to run ona host computer at the same time. Some hypervisors take the form ofsoftware that runs directly on a given hardware platform as an operatingsystem control program. With this kind of hypervisor, the guestoperating system runs at the second level above the hardware. Otherhypervisors take the form of software that runs within an operatingsystem environment.

Hypervisors have conventionally been used in multi-terminal systemswhere each terminal has a dedicated guest operating system on a singlehost computer. In these conventional multi-terminal systems, I/O devicescommunicate I/O data through the hypervisor to perform basic I/Ooperations (see DEFINITIONS section). More specifically: (i) data fromthe I/O devices is communicated through the hypervisor to the computinghardware of the host computer; and (ii) from the computing hardware (ifany) is communicated through the hypervisor to the I/O devices. Becausethe hypervisor is a virtualization platform, this means that the I/Odevices must be virtualized in the software of the hypervisor and/or theguest operating system so that the communication of I/O data through thehypervisor can take place.

FIG. 1 shows prior art computer system 100 including: desktop PC 102 andfour terminals 104 a, 104 b, 104 c and 104 d. Desktop PC 102 includes:video card 110; I/O ports 112; CPU 114; host operating system (“OS”)116; virtualizing middleware 118, four guest OS's (see DEFINITIONSsection) 120 a, 120 b, 120 c, 120 d; and four guest applications 122 a,122 b, 122 c and 122 d. Each terminal 104 includes: display 130 andkeyboard-mouse-audio (“KMA”) devices 132. Host OS may be any type of OS,such as Windows, Apple or POSIX (see DEFINITIONS section). As shown inFIG. 1, host OS 116 runs at security level (see DEFINITIONS section) L0,which may be, for example in an x86 CPU architecture, Ring Zero. Thismeans that host OS 116 exchanges instructions directly with CPU 116 innative form (see DEFINITIONS section).

The guest OS's 120 a, 120 b, 120 c, 120 d are used to respectivelycontrol the four terminals 104 a, 104 b, 104 c, 104 d. This means thatthe four guest OS's: (i) control the visual displays respectively shownon displays 130 a, 130 b, 130 c, 130 d; (ii) receive input from the fourkeyboards 132 a, 132 b, 132 c, 132 d; (iii) receive input from the fourmice 132 a, 132 b, 132 c, 132 d; and (iv) control audio for the fouraudio output devices (for example, speakers, headphones) 132 a, 132 b,132 c, 132 d. The four guest OS's 120 a, 120 b, 120 c, 120 d arecontainerized virtual machines so that work by one user on one terminaldoes not affect or interfere with work by another user on anotherterminal. As shown in FIG. 1, they can respectively run their ownapplication(s) 122 a, 122 b, 122 c, 122 d in an independent manner.

However, the four guest OS's are virtual machines, running at a securitylevel 13, which is above the OS security level (see DEFINITIONS section)L0. For example, in an x86 architecture, the guest OS's 120 a, 120 b,120 c, 120 d would be running at Ring Three. This is an indirect form ofcommunication with the CPU 114. Furthermore, the instructions exchangedbetween the guest OS's and the CPU are virtualized by virtualizingmiddleware 118, which may take the form of a hypervisor or virtualmachine manager (“VMM”). For example, some of the exchanged instructionsrelate to basic I/O operations. When the exchanged instructions arevirtualized by virtualizing middleware 118, the instructions are takenout of their native form and put in a virtualized form. This virtualizedform is generally a lot more code intensive than native form. Thisvirtualization makes operations slower and more prone to error thansimilar exchanges between a host OS, running at the OS security leveland the CPU.

It is conventional to run one type of operating system, buts still useapplication(s) written for an operating system of a different type. Someconventional systems for doing that will now be discussed.

FIG. 8 shows prior art computer system 140 including: CPU 142; POSIXoperating system (OS) 144; and Berkeley Software Distribution (BSD)application 148. POSIX OS 144 includes a BSD socket (see DEFINITIONSsection) 146 programmed to allow the BSD application 148 to run on thePOSIX OS 144. However, systems according to the architecture of system140 are not always easily achieved as will now be explained inconnection with FIG. 9.

FIG. 9 shows a possible prior art computer system 150 including: CPU152; Windows operating system (OS) 154; and LINUX application 148.Windows OS 154 includes a LINUX API 156 programmed to allow the LINUXapplication 158 to run on the Windows OS 154. This system 150 isdenominated as “possible” prior art because it is a type of system thatseems to be seldom, if ever, actually practiced. This may be due todifficulties in updating the LINUX API 156 to stay current with theunderlying Windows OS 154 and/or overlying LINUX application 158, and/ordifficulties involving proprietary code issues.

FIG. 10 shows prior art computer system 160 including: local computer162; network 164 and POSIX application server computer 166. Localcomputer 162 includes: CPU 168; network interface card (NIC) 170;Windows operating system 172; and XMing module 174. POSIX applicationserver computer 166 includes: CPU 178; network interface card (NIC) 186;POSIX operating system 180; and POSIX application 184. POSIX OS 184includes a POSIX socket 182 programmed to allow the POSIX application184 to run on the POSIX OS 180. System 160 overcomes the difficulties ofrunning a POSIX (for example, LINUX) application by a user who is usinga Windows operating system. The remote POSIX application server computer186 can run the POSIX application(s) because it has the appropriatePOSIX OS and socket(s). Inputs to this remote POSIX application(s) andoutputs from this remote POSIX application are respectively sent andreceived through NIC's 170, 186 and network 164. The special Windowsmanager module XMing 174 at local computer 162 incorporates datareceived from the remote POSIX application server computer 166 as awindow in the Windows display generated by Windows OS 172.

One disadvantage is that the inputs and outputs of the POSIXapplication(s) must be packetized and de-packetized by NIC's 170, 186and sent through the switches of network 164. This makes the running ofthe POSIX application effectively slower and less reliable from theperspective of the user of local computer 162.

FIG. 11 shows system 188, which is a variation on system 160. Computersystem 188 includes: local computer 189; video output 190; CPU 191;POSIX host OS 192; virtualizing middleware 193; Windows guest OS 194 andPOSIX application 196. POSIX host OS 192 includes socket 197 for runningPOSIX application 196 right at the local computer 189. Instead ofsending POSIX application output data back to XMing 195 through actualNIC's and the switches of an actual network, the output data of thePOSIX application is instead sent through virtual network module 198(including virtual switches) and virtual NIC 199 included in thevirtualizing middleware 193. Once again, though this solution takes timeboth because of the de-packetizing/packetizing involved, and alsobecause virtualization is a code-intensive process that causesrelatively large instructions to be transmitted through the system toachieve the POSIX application effectively running on Windows operatingsystem. It is also noted that other instructions (for example, I/Odevice related instructions) that must be exchanged between the Windowsguest OS 194 and CPU 191 are also virtualized by the virtualizingmiddleware, which is a further disadvantage of prior art system 188.

Other publications potentially of interest include: (i) US publishedpatent application 2008/0092145 (“Sun”); (ii) US published patentapplication 2006/0267857 (“Zhang”); (iii) US patent application2007/0174414 (“Song”); (iv) Applica PC Sharing Zero Client NetworkComputing Remote Workstation powered by Applica Inc. (seewww.applica.com website, cached versions 31 Jul. 2007 and earlier); (v)US patent application 2003/0018892 (“Tello”); (vi) US patent application2007/0097130 (“Margulis”); (vii) US patent application 2008/0168479(“Purtell”); (viii) U.S. Pat. No. 5,903,752 (“Dingwall”); (ix) US patentapplication 2007/0028082 (“Lien”); (x) US patent application2008/0077917 (“Chen”); (xi) US published patent application 2007/0078891(“Lescouet”); (xii) US published patent application 2007/0204265(“Oshins”); (xiii) US published patent application 2007/0057953(“Green”); (ix) US patent application 2004/0073912 (“Meza”); (x) USpatent application 2007/0043928 (“Panesar”); and/or (xi) US patentapplication 2007/0174410 (“Croft”).

Description Of the Related Art Section Disclaimer: To the extent thatspecific publications are discussed above in this Description of theRelated Art Section, these discussions should not be taken as anadmission that the discussed publications (for example, publishedpatents) are prior art for patent law purposes. For example, some or allof the discussed publications may not be sufficiently early in time, maynot reflect subject matter developed early enough in time and/or may notbe sufficiently enabling so as to amount to prior art for patent lawpurposes. To the extent that specific publications are discussed abovein this Description of the Related Art Section, they are all herebyincorporated by reference into this document in their respectiveentirety(ies).

BRIEF SUMMARY OF THE INVENTION

The present invention is directed to a computer system with a CPU, atleast one guest operating system and a controller kernel. The controllerkernel includes a socket for running an application on the controllerkernel itself. The controller kernel also includes a video integrationmodule so that video output data from the guest OS may be combined withvideo output data from the guest OS. In this way, a user of the guest OScan use an application by tunneling, and without the need to virtualizethe video output data of the application running on the controllerkernel in order to incorporate it with the video output data of theguest OS. This is especially preferred when the controller kernel iswritten in a different form than the guest OS, such as when thecontroller kernel is in LINUX and the guest OS is in a Windows formbecause it allows a guest OS of one form (for example, Windows) toreliably, quickly, efficiently and robustly run applications written inanother form (for example, LINUX).

Some preferred embodiments of the present invention include multipleguest operating systems that exchange instructions in native form (seeDEFINITIONS section) with the CPU under control of the controllerkernel. Some preferred embodiments of the present invention includemultiple, containerized (see DEFINITIONS section) guest operatingsystems so that the application(s) running on the controller kernel canbe separately and independently run by the various guest OS's. Somepreferred embodiments of the present invention include both multipleguest OS's and multiple terminals (see DEFINITIONS section) respectivelyrun by the guest OS's. Some preferred embodiments of the presentinvention include software module(s) to help search for applicationssuitable to run on the controller kernel. Some preferred embodiments ofthe present invention include software module(s) to help filter whichapplications are permitted to be run on the controller kernel.

Various embodiments of the present invention may exhibit one or more ofthe following objects, features and/or advantages:

(1) reliably, quickly, efficiently and/or robustly run application(s)written in one form (for example, LINUX) to run in conjunction with anoperating system of another form (for example, Windows);

(2) run application(s) written in one form (for example, LINUX) to runin conjunction with an operating system of another form (for example,Windows) without virtualizing the application related data; and/or

(3) run application(s) written in one form (for example, LINUX) to runin conjunction with an operating system of another form (for example,Windows) without packetizing the video output data of the application(s)and/or without sending it through a virtual switch.

According to a first aspect of the present invention, a computer systemincludes processing hardware, a first guest operating system, acontroller kernel, and a first application program. the controllerkernel runs on the processing hardware, with the controller kernel beingprogrammed to allow the first guest operating system to receive firstnative form video frame data from the processing hardware through thecontroller kernel, and with the controller kernel including a firstsocket. The first application program is programmed to generate firstapplication display data when it runs. The first socket is programmed torun the first application program. The controller kernel is programmedto receive the first application display data and to incorporate thefirst application display data into the first native form video framedata.

According to a further aspect of the present invention, a computerincludes processing hardware, a first OS memory portion, a controllermemory portion, and a first application memory portion. The first OSmemory portion is programmed with a first guest operating system. Thecontroller memory portion is programmed with a controller kernel runningon the processing hardware, with the controller kernel being programmedto allow the first guest operating system to receive first native formvideo frame data from the processing hardware through the controllerkernel, and with the controller kernel including a first socket. Thefirst application memory portion is programmed with a first applicationprogram programmed to generate first application display data when itruns. The first socket is programmed to run the first applicationprogram. The processing hardware is programmed to receive the firstapplication display data and to incorporate the first applicationdisplay data into the first native form video frame data.

According to a further aspect of the present invention, a processincludes the following steps: (i) providing a computer system comprisingprocessing hardware, a first guest operating system, a controllerkernel, a first application program, with the controller kernelcomprising a first socket; (ii) running the controller kernel on theprocessing hardware; (iii) running the first application program on thefirst socket; (iv) generating, by the first application program, firstapplication display data; (v) sending the first application display datafrom the socket to the processing hardware; and (vi) incorporating, bythe processing hardware, the first application display data into a firstnative form video frame data.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more fully understood and appreciated byreading the following Detailed Description in conjunction with theaccompanying drawings, in which:

FIG. 1 is a schematic of a prior art computer system;

FIG. 2 is a perspective external view of a first embodiment of acomputer system according to the present invention;

FIG. 3 is a schematic of the first embodiment computer system;

FIG. 4 is a more detailed schematic of a portion of the first embodimentcomputer system;

FIGS. 5A, 5B, 5C and 5D are a flowchart of a first embodiment of amethod according to the present invention;

FIG. 6 is a of a second embodiment of a computer system according to thepresent invention; and

FIGS. 7A and 7B are a flowchart of a second embodiment of a methodaccording to the present invention;

FIG. 8 is a schematic of another prior art computer system;

FIG. 9 is a schematic of another prior art computer system;

FIG. 10 is a schematic of another prior art computer system;

FIG. 11 is a schematic of another prior art computer system;

FIG. 12 is a of a third embodiment of a computer system according to thepresent invention; and

FIG. 13 is a of a fourth embodiment of a computer system according tothe present invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 2 shows computer system 200 according to the present invention,including desktop PC 202 and four terminals 204 a, 204 b, 204 c and 204d. Desktop PC 202 could alternatively be any other type of computer nowknown or to be developed in the future, such as a laptop, a tablet, amini computer, a mainframe computer, a super computer, a blade, etc.Terminals 204 each includes I/O devices in the form of a display, akeyboard, a mouse and an audio device. The display is the primary outputdevice and may be any type of display now known or to be developed inthe future, such as an LCD display or a CRT display. Alternatively oradditionally, other output devices could be present, such as printers,lights (LEDs) and/or vibrating output devices. The keyboard, mouse andaudio speakers are the primary input devices, but they may includeoutput capabilities as well. Alternatively or additionally, there may beother output devices of any type now known or to be developed in thefuture, such as drawing tablets, joysticks, footpads, eyetracking inputdevices, touchscreens, etc.

Preferably, the display of each terminal 204 is connected to be indisplay data communication with desktop PC 202 by a standard paralleldisplay connection, but may be connected by any appropriate dataconnection now known or to be developed in the future, such as awireless connection. Preferably, the input devices of terminal 204 areconnected to desktop PC 202 by a USB connection. Alternatively, they maybe connected by any means now known or to be developed in the future,such as PS2 connection or wireless connection. One or more USB hubs maybe used between desktop PC 202 and the input devices of terminals 204.

Terminals 204 are preferably ultra thin terminals (see DEFINITIONSsection). Alternatively, some or all terminals 204 could include aclient computer with memory and processing capability. Terminals 204 mayalso include an I/O port for a portable memory, such as a USB port for adetachably attachable USB flash memory or jump drive.

FIG. 3 is a schematic of system 200 including desktop PC 202; terminals204; video card 210; I/O ports 212; CPU 214; POSIX kernel 215; fourguest OS's 220 a, 220 b, 220 c, 220 d; four guest applications 222 a,222 b, 222 c, 222 d; four displays 230 a, 230 b, 230 c, 230 d; and foursets of KMA devices 232 a, 232 b, 232 c, 232 d.

Video card 210 has at least four outputs to supply display data to thefour display devices 230 a, 230 b, 230 c, 230 d. Although not shown,video card 210 may have at least one additional output for: (i)additional terminals; and/or (ii) use with the POSIX kernel and/or anyhost operating system that may be present. The video card may take theform of multiple video cards.

The CPU may be any type of processing hardware, such as x86 architectureor other Windows type, Apple type, Sun type, etc. The hardware structureof the CPU will determine the native form for the instructions that itgives and receives. For this reason, the guest OS's 220 a, 220 b, 220 c,220 d must be fully compatible with CPU 214. Importantly, there issubstantially no virtualizing middleware layer in desktop PC 202 tocorrect for any incompatibilities.

The POSIX kernel is preferably a LINUX kernel because LINUX is opensource and also because a LINUX kernel can be expanded to run LINUXapplications. Alternative, the kernel may be written in other formats tobe compatible with the CPU such as Windows or BSD.

The PC 202 preferably includes a software algorithm (not shown) thatloads the POSIX kernel (Linux 2.6 preferably) onto an availablemotherboard EEPROM instead of the currently installed proprietary BIOS.The kernel, along with several other helpful C based programs preferablyrun in 32 bit mode, as opposed to the current method of running the BIOSin 16 bit mode. These programs preferably include BusyBox, uClibc, andXII. The result is a greatly decreased boot time. All of this ispreferably run in the cache memory of the CPU instead of normal DRAM.The reason for this is that DRAM is normally initialized by the BIOS andcan't be used until it is initialized. The first program that runs isalso written in C and it is what initializes and uses this CPU memory.

Once this is loaded, a larger module is called. This would typically beinvoked from the hard drive. The POSIX kernel 215 does not necessarilyhave any sockets or run any applications. It may only runs sub-modulesthat control multiple video, keyboard, mouse, and the audio devices formultiple, concurrent local connections. Current technology will allowonly one user to use the system at a time using one set of keyboard,mice, and monitors. These modules have been modified to allow multipleinputs (keyboards and mice) and outputs (audio and video) devices to beused independently and concurrently. Preferably, the terminals 204 arenot remotely located, but, in some embodiments of the invention, theymay be.

Preferably, the terminals are located on the same machine and the outputgoes directly via the system bus to the associated devices resulting inmulti-user system with very little slow-down. It utilizes the excess CPUpower that is available to control multiple sessions just like in a“thin client” environment. The difference is that in a “thin client”environment the output is converted to TCP-IP protocol and sent via anetwork connection. This conversion and packeteering of video results inslow screen redraws. This ability to run multiple “sessions” iscurrently available with Linux (XII) and Windows (RDP), on remotemachines but the remote machines must have the necessary hardware andsoftware necessary to locally control the keyboard, mouse, audio andvideo devices. Because everything is preferably loaded from the localEEPROM, boot up from power-on to login is approximately 6 seconds. Thiscompares favorably to current Windows, MacIntosh, or Linux startup timesof 30-50 seconds.

These modifications allow for a natural separation of the “sessions” toa great degree. Because of this, the invention is able to take advantageof the scheduling components and modularity of Linux to use it as asupervisor for other operating systems to run concurrently. This canefficiently install one guest operating system (for example, a Windowsguest OS) in conjunction with each set of keyboards, mice, and monitors.

FIGS. 7A and 7B are a flowchart showing exemplary process flow for theexchange of instructions between the guest OS's 220 and the CPU 214through the POSIX kernel 215 according to the present invention. Thisflowchart will now be discussed in narrative terms, after whichdiscussion, FIG. 3 will be further discussed. Using a modified Linuxinterrupt service code, . . . /kernel/entry-v.s, the idle loop, . . ./kernel/process.c, and a modified Interrupt Descriptor Table, this cancontrol and tell if a system “session” is: (i) running; (ii) notrunning; or (iii) pre-empted. The kernel has priority for all actions,but since it is only providing low throughput I/O control and videorendering (video is mostly handled by the GPU on the video card),preemption by the host kernel is very low in proportion to time allowedfor the “clients.”

Since the architecture is the same for both the host (Linux kernel) andthe local “client” (x86-32 bit or 64 bit) operating system, there islittle need for emulation of hardware and most instructions can be rundirectly on the applicable hardware. All CPU requests can be dynamicallyscheduled by the controller kernel and run in Ring Zero of the machine.If a protected call, privileged instruction, system trap, or page faultis presented that will not run properly or does not have permission torun in this unified system then it is moved to Ring Three. Ring Three isnormally unused on an Intel system. All memory calls are directed toprotected and pre-allocated memory locations. All hardware except video,ethernet, and audio devices is directly accessed by the “client” OS.Video, ethernet, and audio devices are virtualized, off-the-shelfdrivers. Raw I/O from these devices is sent through the modified Linuxidle loop and Interrupt Descriptor Table to the “real” hardware in aprioritized fashion. This allows a number of segregated “sessions” to berun at near native speed.

This is done without hardware virtualization extension techniques ascurrently available with the Intel VT or AMD V/SVM CPU chips, hardwareemulation (VMWARE, QEMU, Bochs, etc.), or hypervisors like Xen or KVM(these require modification of source code). Finally, products likeCooperative Linux and UserMode Linux work with Windows as the host andLinux as the “guest” because the guest in this case (Linux) can bemodified to give up control of the hardware when Windows asks for it.Since Windows can't easily be modified this concept has not beenrealized in reverse, for example Linux as host and Windows as guest.This aspect of the present invention is the reverse of this in thatLinux is the host and Windows is the guest.

It may be difficult to modify the guest OS (for example, Windows) togive up control when the host (supervisor) asks for it, we can use/kernel/process.c (idle loop) and /kernel/entry-v.s (interrupt service)and the Interrupt Descriptor Table to trap privileged instructions andforce the guest (Windows) to wait, until it is no longer preempted. Inother words, we have modified the controller kernel (Linux) to put therequests of the guest (Windows) into the Linux idle loop if the guest ispreempted. Since the host is not running applications, since it is onlycontrolling I/O, the wait time during this preemption period is veryshort and it is not apparent to the user. Finally, when privilegedinstructions are trapped to Ring Three, the instructions are recompiled(sometimes on the fly) using QEMU recompilation code so that the nexttime this situation repeats itself, the trap is not needed.

Now that the operation of POSIX kernel has been explained in detail,discussion will return to FIG. 3. The guest OS's 220 are preferablyWindows OS's, such as Windows XP or Windows Vista. Alternatively, anytype of guest OS now known or to be developed in the future may be used.In some embodiments of the invention, there will be but a single guestOS. For example, Windows Vista has been found to run faster when runthrough the POSIX kernel according to the present invention. In someembodiments of the invention, the guest OS's will be different from eachother. For example, there may be a Windows XP OS, a Windows Vista OS, anUbuntu LINUX OS and a BSD OS. Systems with multiple OS's may bepreferred in embodiments of the present invention where there are notmultiple terminals, but rather a single set of I/O devices connected todesktop PC 202 in the conventional way. In these single terminalembodiments, a single user can switch between various operating systemsat will, taking advantage of native applications 222 for a variety ofoperating systems on a single physical machine.

FIG. 4 shows a more detailed schematic of POSIX kernel 215 including:critical portion 215 a; non-critical portion 215 b; interrupt descriptortable 250; idle loop 252; and POSIX socket 254. Critical portion 215 ais critical because this is the portion that passes instructions innative form between CPU 214 and guest OS's 220. In a sense, criticalportion 215 a takes the place of the virtualizing middleware of theprior art, with the important differences that: (i) the POSIX kernelpasses instructions in native form, rather than translating them intovirtualized or emulated form at intermediate portions of the exchange;and/or (ii) the POSIX kernel permits the guest OS's to run at an OSsecurity level (for example, Ring Zero or Ring One), rather than ahigher security level (see FIG. 3 at reference numeral LO). It is notedthat applications running on top of the guest OS's will run at a highersecurity level (see FIG. 3 at reference numeral L3), such as, forexample, Ring Three. In other words, despite the presence of the kernel,guest OS's run at the security level that a host OS would normally runat in a conventional computer.

In this preferred embodiment of the present invention, the POSIX kernelaccomplishes the exchange of native form instructions using interruptdescriptor table 250 and idle loop 252. Interrupt descriptor table 250receives requests for service from each of the guest OS's. At any giventime it will return a positive service code to one of the guest OS's andit will return a negative service code to all the other guest OS's. Theguest OS that receives back a positive return code will exchangeinstructions in native form with the CPU through idle loop 252. Theother guest OS's, receiving back a negative return code from interruptdescriptor table 250 will be pre-empted and will remain running untilthey get back a positive return code.

Preferably, and as shown in the flow chart of FIGS. 5A to D, theinterrupt descriptor table cycles through all the guest OS's over acycle time period, so that each guest OS can exchange instructions withthe CPU in sequence over the course of a single cycle. This isespecially preferred in embodiments of the present invention havingmultiple terminals, so that different users at the different terminalsunder control of their respective guest OS's can work concurrently.Alternatively, the interrupt descriptor table could provide for othertime division allocations between the various guest OS's. For example, auser could provide user input to switch between guest OS's. This form oftime division allocation is preferred in single terminal, multipleoperating system embodiments. There may be still other methods of timedivision allocation, such as random allocation (probably not preferred)or allocation based on detected activity levels at the variousterminals.

Non-critical portion 215 b shows that the controller kernel may beextended beyond the bare functionality required to control the exchangeof instructions between the guest OS's and the CPU. For example, a POSIXsocket may be added to allow POSIX applications to run on the kernelitself. Although the kernel is called a kernel herein, it may beextended to the point where it can be considered as a host operatingsystem, but according to the present invention, these extensions shouldnot interfere (that is virtualize or emulate) instructions beingexchanged through the kernel in native form between the guest OS(es) andthe CPU.

FIGS. 5A to 5D show an embodiment of process flow for one cycle for theexchange of instructions in native form between guest OS's 220 and CPU214 through a kernel including an interrupt descriptor table and an idleloop. The process includes: a first portion (steps S302, S304, S306,S308, S310, S312, S314, S316, S318); a second portion (steps S320, S322,S324, S326, S328, S330, S332, S334, S336); a third portion (steps S338,S340, S342, S344, S346, S348, S350, S352, S354); and a fourth portion(steps S356, S358, S360, S362, S364, S366, S368, S370, S372).

The cycle has four portions because four guest OS's (and no host OS's)are running—each portion allows the exchange of instructions between oneof the four guest OS's and the CPU so that all four operating systemscan run concurrently and so that multiple users can respectively use themultiple operating systems as if they had a dedicated computer insteadof an ultra thin terminal.

Preferably, the entire cycle allows each OS to get a new video frameabout every 30 microseconds (MS). In this way, each terminal displaygets a about 30 frames per second (fps), which results in a smoothdisplay. Above 30 frames per second, there is little, if any,improvement in the appearance of the video, but below 30 fps, thedisplay can begin to appear choppy and/or aesthetically irritating.Because the cycle time, in this four portion embodiment is preferablyabout 30 MS to maintain a good 30 fps frame rate in the displays, thismeans that each cycle portion is about 30/4 MS, which equals about 8 MS.With current CPUs, 8 MS out of 30 MS is sufficient to handle most commonapplications that would be run at the various guest OS's, such as wordprocessing, educational software, retail kiosk software, etc. As CPU'sget faster over time, due to improvements such as multiple cores, itwill become practical to have a greater number of guest operatingsystems on a single desktop computer—perhaps as many as 40 OS's or more.

FIG. 6 is a schematic of a second embodiment computer system 400according to the present invention including: guest OS 402 a; guest OS402 b; guest OS 402 c; guest OS 402 d; hardware control sub-modules 408;controller kernel 410; hard drive 414; hardware layer; and EEPROM 418.Hardware control sub-modules 408 include the following sub-modules:network interface card (NIC) 434; keyboard 436; mouse 438; audio 440;video 442, memory 444 and CPU 446. Controller kernel 410 includes thefollowing portions: kernel process module 448; kernel entry module 450;idle loop 452; interrupt service code 454; and interrupt descriptortable 456. Hardware layer 416 includes the following portions: networkinterface card (NIC) 420; keyboard 422; mouse 424; audio 426; video 428,memory 430 and CPU 432.

As shown by the guest OS boxes 402, the operating systems arecontainerized. As shown schematically by arrow 404, the presentationlayer in this embodiment is Windows. As shown schematically by arrow406, there are OS containers and virtual drivers for NIC, audio andvideo. Additionally, there may be additional modules, such as videoacceleration modules. The hardware control sub-modules 408 are directaccess drivers and may additionally include other sub-modules, such as avideo acceleration module. The EEPROM 418 is the normal location forBIOS, but in this embodiment of the present invention is loaded with thecontroller kernel 410 and X11. EEPROM 418 invokes the hard drive afterthe initial boot up. The control kernel is invoked from hard drive 414during the original EEPROM 418 boot. At the NIC portion 420, it is notedthat each card preferably has its own MAC address and own IP address.

FIGS. 7A and 7B, discussed above, show a more detailed embodiment of theprocess flow through an interrupt descriptor table and idle loop in aLINUX controller kernel according to the present invention. Figures &Aand 7B include LINUX control kernel level steps 502; Head 1 steps 504and Head 2 steps 506.

FIG. 12 shows computer system 600 according to the present invention,including: CPU 614; POSIX controller kernel 615; guest OS 620; POSIXapplication A 658; POSIX application B 660; POSIX application C 662; andvideo output 691. The POSIX controller kernel includes: videointegration module 650; POSIX socket A 652; POSIX socket B 654; andPOSIX socket C 656. In preferred embodiments of the invention, guest OS620 is either in a non-POSIX form, or at least in a form that is adifferent variant of POSIX (for example, LINUX) than that of thecontroller kernel (which might be UNIX).

The controller kernel 615 may be largely similar to the kernels ofprevious embodiments discussed above. The video integration module 650:(i) accepts video output data in native form guest OS 620; (ii) acceptsvideo output data in native form from POSIX applications 658, 600, 662(through their respective sockets 652, 654, 656); and (iii) combinesand/or integrates this video data to form a single display in nativeform. The single display generated at item (iii) is then sent throughthe CPU 615 to video output 691.

The controller kernel may also communicate additional data in nativeform (such as I/O device related data) between guest OS 620 and POSIXapplications 658, 660, 658. Advantageously, the data (and especially thevideo data) is not packetized, put in emulated form, virtualized and/orcommunicated through a virtual switch. Also, the guest operating systemdoes not require a special windows manager, like XMing, and needs onlyto use its native windows manager in creating its video output data.This direct form of data communication through the kernel between aguest OS running on the kernel and other applications running directlyon the kernel is tunneling according to the present invention.

FIG. 13 shows computer system 700 according to the present inventionincluding: CPU 714; video card 713; three terminal displays 730 a,b,c;LINUX controller kernel 715; three guest Windows OS's 720 a,b,c; LINUXapplication A 758; LINUX application B 760; and LINUX application C 762.The kernel 715 includes: video integration module 750; LINUX applicationsocket A 752; LINUX application socket B 754; LINUX application socket C756; LINUX application filter module 770; and LINUX application searchmodule 772. Each guest OS 720 a,b,c includes: LINUX application filtermodule 774 a,b,c; and LINUX application search module 776 a,b,c.

In system 700, the three containerized guest OS's are used to run threeindependent terminals. Video integration module 750 integrates videodata in native form from each of the guest OS's 714 a,b,c and from anyapplicable LINUX applications 758, 760, 762 to form combined videooutput data to be displayed on the displays 730 a,b,c of the variousterminals. Terminal 730 c shows such a combined display including: LINUXwindow A 780; Windows window A 782; an LINUX window B 784. In this way,users of each terminal are in an independent and familiar computingenvironment created by their respective guest OS, but also have accessto various LINUX applications as well through the tunneling of thepresent invention.

In system 700, both the guest OS's 720 and the kernel 715 have searchmodules. Alternatively, the search module could be only in the guestOS's, only in the kernel, run as an application on top of the variousguest OS's or run as an application on the kernel. Regardless of itslocation(s) in the system, the search modules are modules that helpusers of the guest OS's find desirable applications that can run on thekernel through tunneling. This can be especially advantageous when thekernel can run open source applications because these are numerous andcan be hard to find without help.

In system 700, both the guest OS's 720 and the kernel 715 have filtermodules. Alternatively, the filter module could be only in the guestOS's, only in the kernel, run as an application on top of the variousguest OS's or run as an application on the kernel. Regardless of itslocation(s) in the system, the filter module can be used so that asystem administrator or other interested party can prevent undesiredapplications from being run on and/or accessed through the kernel. Thefilter may be opt-out style (that is, in the form of a list of forbiddenapplications) or opt-in style (that is, in the form of a closed list ofapproved applications). Instead of merely forbidding/approving theapplications, the filter may alternatively or additionally providepassword protection and/or metering for the applications run on thecontroller kernel. This filtering can be especially advantageous in achild's educational environment for many possible reasons: (i) helpselect best pedagogical tools for the child; (ii) help prevent minorfrom accessing harmful matter; (iii) prevent confusion and beingoverwhelmed by too many open source applications; (iv) allow selectiveaccess depending on the identity of the teacher or student; and (v)allow limited time, time period and/or bandwidth access for applicationsthat are partially or wholly entertainment oriented.

Definitions

The following definitions are provided to facilitate claiminterpretation:

Present invention: means at least some embodiments of the presentinvention; references to various feature(s) of the “present invention”throughout this document do not mean that all claimed embodiments ormethods include the referenced feature(s).

First, second, third, etc. (“ordinals”): Unless otherwise noted,ordinals only serve to distinguish or identify (e.g., various members ofa group); the mere use of ordinals implies neither a consecutivenumerical limit nor a serial limitation.

receive/provide/send/input/output: unless otherwise explicitlyspecified, these words should not be taken to imply: (i) any particulardegree of directness with respect to the relationship between theirobjects and subjects; and/or (ii) absence of intermediate components,actions and/or things interposed between their objects and subjects.

containerized: code portions running at least substantiallyindependently of each other.

terminal/terminal hardware set: a set of computer peripheral hardwarethat includes at least one input device that can be used by a human userto input data and at least one output device that outputs data to ahuman user in human user readable form.

ultra thin terminal: any terminal or terminal hardware set that hassubstantially no memory; generally ultra thin terminals will have nomore processing capability than the amount of processing capabilityneeded to run a video display, but this is not necessarily required.

basic I/O operations: operations related to receiving input from ordelivering output to a human user; basic I/O operations relate tocontrol of I/O devices including, but not limited to keyboards, mice,visual displays and/or printers.

guest OS: a guest OS may be considered as a guest OS regardless ofwhether: (i) a host OS exists in the computer system; (ii) the existenceor non-existence of other OS's on the system; and/or (iii) whether theguest OS is contained within one or more subsuming OS's.

security level: a level of privileges and permissions for accessing orexchanging instructions with processing hardware; for example, sometypes of processing hardware define security levels as Ring Zero (levelof greatest permissions and privilege), Ring One, Ring Two, and so on;not all security levels may be used in a given computer system.

OS security level: any security level defined in a given system that isconsistent with normal operations of a typical operating system runningdirectly on the processing hardware (and not as a virtual machine); forexample, for an Intel/Windows type of processing hardware Ring Zero,Ring One and perhaps Ring Two would be considered as “OS securitylevels,” but Ring Three and higher would not.

native form: a form of instructions that can be operatively received byand/or is output from processing hardware directly and without any sortof translation or modification to form by software running on thehardware; generally speaking, different processing hardware types arecharacterized by different native forms.

POSIX: includes, but is not limited to, LINUX.

processing hardware: typically takes the form of a central processingunit, but it is not necessarily so limited; processing hardware is notlimited to any specific type and/or manufacturer (for examples,Intel/Windows, Apple, Sun, Motorola); processing hardware may includemultiple cores, and different cores may or may not be allocated todifferent guest operating systems and/or groups of operating systems.

socket: any socket and/or API now known or to be developed in thefuture, with out regard to: (i) whether the socket is considered to beincluded within and/or integral with its underlying OS.

Kernel: a kernel may take the form of an operating system.

Operating system: an operating system may take the form of a kernel.

Computer system: any computer system without regard to: (i) whether theconstituent elements of the system are located within proximity to eachother; and/or (ii) whether the constituent elements are located in thesame housing.

Exchange instructions: includes: (i) two way exchanges of instructionsflowing in both directions between two elements; and/or (ii) one waytransmission of instructions flowing in a single direction from oneelement to another.

Memory portion: any portion of a memory structure or structures,including, but not necessarily limited to, hard drive space, flashdrive, jump drive, solid state memory, cache memory, DRAM, RAM and/orROM; memory portions are not limited to: (i) portions with consecutivephysical addresses; (ii) portions with consecutive logical address;(iii) portions located within a single piece of hardware; (iv) portionslocated so that the entire portion is in the same locational proximity;and/or (v) portions located entirely on a single piece of hardware (forexample, in a single DRAM).

cycle: any process that returns to its beginning and then repeats itselfat least once in the same sequence.

selectively allow: the selectivity may be implemented in many, variousways, such as regular cycling, user input directed, dynamicallyscheduled, random, etc.

pre-empt: includes, but is not limited to, delay, queue, interrupt, etc.

To the extent that the definitions provided above are consistent withordinary, plain, and accustomed meanings (as generally shown bydocuments such as dictionaries and/or technical lexicons), the abovedefinitions shall be considered supplemental in nature. To the extentthat the definitions provided above are inconsistent with ordinary,plain, and accustomed meanings (as generally shown by documents such asdictionaries and/or technical lexicons), the above definitions shallcontrol. If the definitions provided above are broader than theordinary, plain, and accustomed meanings in some aspect, then the abovedefinitions shall be considered to broaden the claim accordingly.

To the extent that a patentee may act as its own lexicographer underapplicable law, it is hereby further directed that all words appearingin the claims section, except for the above-defined words, shall take ontheir ordinary, plain, and accustomed meanings (as generally shown bydocuments such as dictionaries and/or technical lexicons), and shall notbe considered to be specially defined in this specification. In thesituation where a word or term used in the claims has more than onealternative ordinary, plain and accustomed meaning, the broadestdefinition that is consistent with technological feasibility and notdirectly inconsistent with the specification shall control.

Unless otherwise explicitly provided in the claim language, steps inmethod steps or process claims need only be performed in the same timeorder as the order the steps are recited in the claim only to the extentthat impossibility or extreme feasibility problems dictate that therecited step order (or portion of the recited step order) be used. Thisprohibition on inferring method step order merely from the order of steprecitation in a claim applies even if the steps are labeled as (a), (b)and so on. This broad interpretation with respect to step order is to beused regardless of whether the alternative time ordering(s) of theclaimed steps is particularly mentioned or discussed in this document.

1. A computer system comprising: processing hardware; a first guestoperating system; a controller kernel running on the processinghardware, with the controller kernel being programmed to allow the firstguest operating system to receive first native form video frame datafrom the processing hardware through the controller kernel, with thecontroller kernel comprising a first socket; and a first applicationprogram programmed to generate first application display data when itruns; wherein: the first socket is programmed to run the firstapplication program; and the controller kernel is programmed to receivethe first application display data and to incorporate the firstapplication display data into the first native form video frame data. 2.The system of claim 2 wherein the controller kernel is furtherprogrammed to send the first native form video frame data through thecontroller kernel to the first guest operating system.
 3. The system ofclaim 2 wherein the first guest operating system comprises a displaymanager module that is native to the guest operating system, with thedisplay manager module being programmed to receive the first native formvideo frame data.
 4. The system of claim 1 further comprising: a firstdisplay structured to display a plurality of successive frames of adisplay over time; and a video card programmed to receive the firstnative form video frame data, to generate a first frame display signalcorresponding to the first native form video frame data and to send thefirst frame display signal to the first display; wherein the firstdisplay is structured and/or programmed to display a frame of theplurality of successive frames corresponding to the first frame displaysignal.
 5. The system of claim 4 wherein the first frame display signalis analog.
 6. The system of claim 4 wherein the first frame displaysignal is digital.
 7. The system of claim 1 wherein the controllerkernel is in POSIX.
 8. The system of claim 1 wherein the first guestoperating system is of a Windows type.
 9. The system of claim 8 whereinthe controller kernel is LINUX.
 10. The system of claim 7 wherein thecontroller kernel is LINUX.
 11. The system of claim 1 further comprisinga first user input device structured and electrically connected toreceive a raw input data from a user, wherein: the first guest operatingsystem is further programmed to receive the raw input data from thefirst user input device and to convert it into user input data in nativeform; the controller kernel is further programmed to receive the userinput data in native form; and the first socket is programmed to use theuser input to at least partially control the manner in which theapplication program runs.
 12. The system of claim 11 wherein the firstuser input device is a keyboard.
 13. The system of claim 1 furthercomprising: a second guest operating system; and a second applicationprogram programmed to generate second application display data when itruns; wherein: the controller kernel is further programmed to allow thesecond guest operating system to receive second native form video framedata from the processing hardware through the controller kernel, withthe controller kernel further comprising a second socket; the secondsocket is programmed to run the application program; and the processinghardware is programmed to receive the second application display dataand to incorporate the second application display data into the secondnative form video frame data.
 14. The system of claim 1 furthercomprising a second display structured to display a plurality ofsuccessive frames of a display over time, wherein: the video card isfurther programmed to receive the second native form video frame data,to generate a second frame display signal corresponding to the secondnative form video frame data and to send the second frame display signalto the second display; wherein the second display is structured and/orprogrammed to display a frame of the plurality of successive framescorresponding to the second frame display signal.
 15. A computercomprising: processing hardware; a first OS memory portion programmedwith a first guest operating system; a controller memory portionprogrammed with a controller kernel running on the processing hardware,with the controller kernel being programmed to allow the first guestoperating system to receive first native form video frame data from theprocessing hardware through the controller kernel, with the controllerkernel comprising a first socket; and a first application memory portionprogrammed with a first application program programmed to generate firstapplication display data when it runs; wherein: the first socket isprogrammed to run the first application program; and the processinghardware is programmed to receive the first application display data andto incorporate the first application display data into the first nativeform video frame data.
 16. The system of claim 15 wherein the controllerkernel is in POSIX.
 17. The system of claim 16 wherein the first guestoperating system is of a Windows type.
 18. A process comprising thesteps of: providing a computer system comprising processing hardware, afirst guest operating system, a controller kernel, a first applicationprogram, with the controller kernel comprising a first socket; runningthe controller kernel on the processing hardware; running the firstapplication program on the first socket; generating, by the firstapplication program, first application display data; sending the firstapplication display data from the socket to the processing hardware; andincorporating, by the processing hardware, the first application displaydata into a first native form video frame data.
 19. The method of claim18 further comprising the step of: sending the first native form videoframe data from the processing hardware to the first guest operatingsystem through the controller kernel.
 20. The system of claim 18wherein: the controller kernel is in POSIX; and the first guestoperating system is of a Windows type.